I85PREP
⌘ K
OCI Migration Architect Pro study materials
OCI Migration Architect Pro study resources

OCI Migration Architect Pro practice questions

One question at a time. Build your OCI Migration Architect Pro understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Migration Strategy, Assessment, and Planning

During an OCI migration assessment, which OCI tool is designed to discover on-premises servers and collect utilization data to right-size target shapes?

  1. OCI Cloud Migration Advisor Correct answer.
  2. OCI Resource Manager
  3. OCI Logging Analytics
  4. OCI Full Stack Disaster Recovery

Explanation

Cloud Migration Advisor performs discovery of on-premises assets and gathers performance telemetry so architects can map workloads to appropriately sized OCI shapes. It is the assessment-phase tool, distinct from provisioning and operational services.

Question 2Migration Strategy, Assessment, and Planning

A team must move a large Oracle Database to OCI with minimal downtime and wants continuous replication from the source. Which approach fits this requirement?

  1. Using RMAN full backup restore only
  2. GoldenGate replication with a controlled cutover Correct answer.
  3. Export and import using Oracle Data Pump during a weekend outage
  4. Cloning the database to a backup appliance

Explanation

GoldenGate provides ongoing logical replication that keeps source and target synchronized, allowing a short cutover window instead of a long outage. Data Pump and RMAN restore both require a downtime window proportional to data size.

Question 3Migration Strategy, Assessment, and Planning

In an OCI migration plan, what is the primary purpose of defining a landing zone before workload cutover?

  1. To establish governed network, identity, and security baselines for incoming workloads Correct answer.
  2. To schedule user training sessions
  3. To estimate software licensing costs
  4. To document application business owners

Explanation

A landing zone provisions the foundational tenancy structure, compartments, identity policies, networking, and guardrails that workloads inherit on arrival. Building it first prevents ad hoc, ungoverned deployments during migration waves.

Question 4Migration Strategy, Assessment, and Planning

An architect is grouping applications into migration waves. Which criterion most directly supports sequencing waves to reduce risk?

  1. Physical rack location in the data center
  2. Number of developers on each team
  3. Business criticality and dependency depth Correct answer.
  4. Alphabetical order of application names

Explanation

Wave sequencing should reflect business criticality, technical dependencies, and complexity so low-risk, well-understood workloads validate the pattern before critical systems move. Dependency depth ensures prerequisite services are available when a wave executes.

Question 5Migration Strategy, Assessment, and Planning

Which OCI capability lets an architect estimate monthly cost for a proposed target architecture before any resources are provisioned?

  1. OCI Cost Analysis
  2. OCI Budgets
  3. OCI Usage Reports
  4. OCI Cost Estimator Correct answer.

Explanation

The Cost Estimator models a hypothetical architecture and returns projected monthly spend, making it suitable for pre-provisioning business cases. Budgets and Cost Analysis operate on resources that already exist.

Question 6Migration Strategy, Assessment, and Planning

A migration team needs to move 200 TB of file data from a data center with a saturated 100 Mbps uplink. Which OCI service is purpose-built for this scenario?

  1. OCI File Storage mount over VPN
  2. OCI Data Transfer service using transfer appliances Correct answer.
  3. OCI Object Storage pre-authenticated requests
  4. OCI Streaming

Explanation

The Data Transfer service ships data physically using transfer appliances, which is appropriate when network bandwidth makes online transfer impractical. At 100 Mbps, 200 TB would take many weeks of dedicated transfer time.

Question 7Migration Strategy, Assessment, and Planning

What does the OCI migration 'six Rs' framework classify as rehosting?

  1. Lifting and shifting a workload to OCI with minimal change Correct answer.
  2. Retiring a redundant application
  3. Refactoring code for cloud-native services
  4. Rebuilding the application from scratch

Explanation

Rehosting, or lift-and-shift, moves a workload to OCI with little or no modification, typically using image import or cloning. It is the fastest strategy and is often used to exit a data center quickly before later optimization.

Question 8Migration Strategy, Assessment, and Planning

Which OCI identity construct should be created first to isolate resources and policies for a specific migrated business unit?

  1. A customer secret key
  2. A dynamic group
  3. A compartment Correct answer.
  4. An auth token

Explanation

Compartments provide the hierarchical container used to scope resources and IAM policies per business unit or environment. Dynamic groups and credentials support access control but depend on an existing compartment structure.

Question 9Migration Strategy, Assessment, and Planning

An application depends on a shared Oracle Database that will remain on-premises during the first migration wave. What should the migration plan document to keep the migrated tier functional?

  1. A revised marketing budget
  2. A new database license purchase
  3. Network connectivity and latency requirements between OCI and on-premises Correct answer.
  4. A replacement for the application's UI framework

Explanation

Hybrid dependencies require explicit connectivity design, such as FastConnect or site-to-site VPN, plus latency and bandwidth validation. Documenting these ensures the migrated application tier can reach the retained database within acceptable performance bounds.

Question 10Migration Strategy, Assessment, and Planning

A workload uses Oracle VM VirtualBox images in the data center. Which OCI migration path is most direct for rehosting it?

  1. Convert the image to a Terraform module
  2. Upload the image to Object Storage and run it as a function
  3. Import the image as a custom image and launch a compute instance Correct answer.
  4. Recreate the workload with a Kubernetes manifest

Explanation

OCI supports importing custom images, including VirtualBox VMDK files, which can then be launched as compute instances. This preserves the existing configuration with minimal change, matching a rehost strategy.

Question 11Migration Strategy, Assessment, and Planning

During assessment, an architect finds an application with hard-coded IP addresses and local disk state. What planning action best addresses these findings?

  1. Exclude it from the migration permanently
  2. Assign it to a later wave without any design change
  3. Schedule the application into the first migration wave unchanged
  4. Flag it for remediation or refactor before migration and document the effort Correct answer.

Explanation

Hard-coded addresses and local state conflict with cloud networking and ephemeral compute, so they represent remediation work that must be estimated in the plan. Identifying this during assessment prevents failed cutovers and unbudgeted effort.

Question 12Migration Strategy, Assessment, and Planning

Which OCI service should be used to centrally manage and apply Terraform configurations for repeatable landing zone deployment across regions?

  1. OCI Bastion
  2. OCI Resource Manager Correct answer.
  3. OCI Vault
  4. OCI Notifications

Explanation

Resource Manager runs Terraform plans and applies against OCI tenancies, enabling repeatable, versioned infrastructure deployment. It supports stacks and jobs that make landing zone rollout consistent across regions.

Question 13Migration Strategy, Assessment, and Planning

A migration plan requires a rollback path for a critical database cutover. Which element is essential to make rollback credible?

  1. A larger target compute shape
  2. A verbal agreement among team members
  3. A validated backup or replica of the source retained until cutover is confirmed Correct answer.
  4. An updated organizational chart

Explanation

A rollback plan is only credible if there is a tested, current copy of the source that can be restored or failed back to within the recovery time objective. Retaining and validating that copy until cutover is confirmed is the essential control.

Question 14Migration Strategy, Assessment, and Planning

An assessment shows an application stores 50 TB in a file share with high small-file churn and shared access from many clients. Which target service best matches these characteristics?

  1. OCI File Storage Correct answer.
  2. OCI Block Volume
  3. OCI Archive Storage
  4. OCI Object Storage standard tier

Explanation

OCI File Storage provides a shared, POSIX-compatible NFS file system suited to many clients accessing a common directory with frequent small-file operations. Object Storage is HTTP-based and lacks native shared file semantics.

Question 15Migration Strategy, Assessment, and Planning

What is the main reason to run a pilot migration of one low-risk application before full-scale waves?

  1. To avoid documenting the target architecture
  2. To reduce the total number of applications migrated
  3. To eliminate the need for a landing zone
  4. To validate the migration pattern, tooling, and runbooks on a small scale Correct answer.

Explanation

A pilot proves the end-to-end migration pattern, including tooling, networking, security, and operational runbooks, before committing critical workloads. Lessons learned are then applied to subsequent waves to reduce risk.

Question 16Migration Strategy, Assessment, and Planning

An architect needs to assess application affinity to the data center, such as latency-sensitive trading systems. Which finding most strongly suggests retaining the workload on-premises or using a hybrid design?

  1. The application has a web front end
  2. The application requires sub-millisecond round trips to specialized hardware Correct answer.
  3. The application is written in Java
  4. The application uses a relational database

Explanation

Sub-millisecond latency to specialized on-premises hardware may be technically or economically infeasible to reproduce in the cloud, favoring retention or a hybrid architecture. Language, database use, and web front ends are generally portable characteristics.

Question 17Migration Strategy, Assessment, and Planning

Which OCI feature helps an architect model target network topology, including subnets, gateways, and security lists, before deployment?

  1. OCI Audit
  2. VCN design captured in the architecture and deployed via Resource Manager Correct answer.
  3. OCI Monitoring
  4. OCI Search

Explanation

A VCN design defines subnets, gateways, route tables, and security rules, and it can be codified and deployed through Resource Manager for consistency. This lets architects validate topology as part of the migration plan.

Question 18Migration Strategy, Assessment, and Planning

A compliance requirement mandates that migrated data remain encrypted with customer-managed keys. Which OCI service should the plan reference for key lifecycle management?

  1. OCI Identity Domains
  2. OCI Data Safe
  3. OCI Network Firewall
  4. OCI Vault Correct answer.

Explanation

OCI Vault manages customer-managed encryption keys and secrets, supporting requirements for key control and rotation. Migration plans should specify Vault usage for services that accept customer-managed keys.

Question 19Migration Strategy, Assessment, and Planning

An application relies on a vendor that supports only x86 architecture, but the team wants to use Ampere A1 shapes for cost savings. What is the correct planning conclusion?

  1. Run the workload on OCI Functions
  2. Migrate to Ampere A1 and rely on emulation in production
  3. Abandon the migration entirely
  4. Keep the workload on an x86-compatible shape or obtain vendor support for Arm Correct answer.

Explanation

Binary compatibility must be confirmed before choosing an Arm-based shape; unsupported vendor software should remain on x86-compatible shapes unless the vendor certifies Arm. Emulation is not a production-grade substitute for native support.

Question 20Migration Strategy, Assessment, and Planning

What should a migration readiness assessment produce to let leadership approve funding for the next phase?

  1. A prioritized inventory, target architecture, risk register, and cost estimate Correct answer.
  2. An unvalidated marketing plan
  3. A single application's source code
  4. A list of employee birthdays

Explanation

A readiness assessment consolidates the application inventory, proposed target architecture, identified risks, and cost projections into a decision package. These artifacts give leadership the basis to approve scope and budget for migration waves.

Question 21Migration Strategy, Assessment, and Planning

A legacy application uses Oracle Database 11g and a business requirement mandates staying on a supported release after migration. Which planning action is correct?

  1. Replace the database with a spreadsheet
  2. Disable patching to preserve behavior
  3. Migrate the 11g database as-is and defer upgrades indefinitely
  4. Plan an upgrade path to a supported database release as part of the migration Correct answer.

Explanation

Unsupported database releases create security and support risk, so the migration plan should include an upgrade to a supported release, often using tooling that minimizes downtime. Bundling the upgrade with migration avoids a second disruptive project later.

Question 22Migration Strategy, Assessment, and Planning

An architect is comparing rehosting versus replatforming a Java application that uses an on-premises message broker. Which consideration most strongly favors replatforming to OCI Streaming?

  1. The team wants to keep the broker on the same physical server
  2. The application has no messaging dependency
  3. The team wants the fastest possible cutover with no code change
  4. The application needs managed, elastic messaging with reduced operational overhead Correct answer.

Explanation

Replatforming trades some code change for managed services that reduce patching, scaling, and operational burden. If elastic, managed messaging is valued over a zero-change cutover, replatforming to OCI Streaming is justified.

Question 23Migration Strategy, Assessment, and Planning

A migration wave includes a stateful clustered application with quorum requirements across nodes. What planning detail is most critical to preserve correct behavior in OCI?

  1. Using burstable shapes for all nodes
  2. Assigning public IP addresses to every node
  3. Placing all nodes in a single availability domain with uniform latency and a valid quorum layout Correct answer.
  4. Disabling all health checks

Explanation

Clustered quorum systems depend on stable, low-latency communication and a topology that satisfies quorum and failure-domain rules. The plan must define placement, latency characteristics, and quorum layout so the cluster does not lose integrity after migration.

Question 24Migration Strategy, Assessment, and Planning

During planning, an architect must decide how to migrate a containerized application currently on Kubernetes in the data center. Which OCI target and planning consideration is most appropriate?

  1. OCI Block Volume attached to each pod
  2. OCI File Storage mounted as the container runtime
  3. OCI Bastion as the container orchestrator
  4. OCI Container Engine for Kubernetes with node pool and image registry planning Correct answer.

Explanation

Container Engine for Kubernetes is the managed Kubernetes target, and the plan must address node pools, networking, and image registry migration. Block volumes attach to nodes rather than pods, and Bastion is an access service, not an orchestrator.

Question 25Migration Strategy, Assessment, and Planning

An assessment reveals that two applications share a database with tightly coupled schemas, and one is scheduled for an earlier wave. What is the soundest planning decision?

  1. Keep tightly coupled applications in the same wave or define an explicit shared-data design Correct answer.
  2. Migrate the earlier application and leave the shared schema split across environments
  3. Migrate both applications without any dependency analysis
  4. Retire the database before either application moves

Explanation

Tightly coupled schemas create cross-environment dependencies that can break transactions and data integrity if split across waves. The plan should co-locate the applications in one wave or define an explicit shared-data architecture with connectivity and ownership.

Question 26Migration Strategy, Assessment, and Planning

In an OCI migration assessment, what is the primary purpose of establishing a baseline of current on-premises resource utilization for each application?

  1. To decide whether the application should be rehosted or retired
  2. To size target OCI shapes and justify the business case with measured rather than assumed capacity Correct answer.
  3. To calculate the exact network latency between the data center and OCI
  4. To determine which OCI region will host the workload after cutover

Explanation

A utilization baseline captures CPU, memory, storage, and IOPS consumption over a representative period, which is the evidence used to right-size target shapes and build a defensible cost comparison. Without measured data, sizing becomes guesswork and the business case is hard to defend. Region selection and rehost-versus-retire decisions depend on other assessment inputs such as latency requirements and business value.

Question 27Migration Strategy, Assessment, and Planning

An architect is defining migration waves for a large portfolio. Which grouping principle produces the most reliable wave plan?

  1. Grouping applications by the alphabetical order of their business owner
  2. Grouping applications by the programming language used in their codebase
  3. Grouping applications by shared dependencies and cutover constraints so related components move together Correct answer.
  4. Grouping applications strictly by the year they were originally deployed

Explanation

Waves should be built around dependency clusters and shared cutover constraints so that tightly coupled components move in a coordinated sequence and risk is contained. Alphabetical, deployment-year, and language groupings ignore the technical and operational coupling that determines whether a cutover succeeds. Dependency-aware waves also make rollback planning tractable because related systems can be reverted together.

Question 28Migration Strategy, Assessment, and Planning

During discovery, an architect needs to inventory servers, installed software, and inter-server communication without installing agents on every host. Which assessment approach fits this requirement?

  1. Manual interviews with application owners only
  2. Reading vendor support contracts for each application
  3. Reviewing the data center's physical floor plan
  4. Agentless network and configuration discovery tooling Correct answer.

Explanation

Agentless discovery uses network scans, configuration management database imports, and protocol-based collection to build a server and dependency inventory without touching each host. This is valuable where agent rollout is impractical across a large estate. Interviews and contracts add context but cannot produce a systematic technical inventory on their own.

Question 29Migration Strategy, Assessment, and Planning

What distinguishes a migration readiness assessment from a full migration plan?

  1. The readiness assessment replaces the need for a business case
  2. The readiness assessment produces production cutover runbooks and rollback scripts
  3. The readiness assessment evaluates feasibility, risk, and gaps to inform a go or no-go decision before detailed planning Correct answer.
  4. The readiness assessment executes the actual data replication to OCI

Explanation

A readiness assessment is a decision-support exercise: it identifies blockers, risks, skill gaps, and remediation actions so leadership can decide whether and how to proceed. Detailed runbooks, replication execution, and the funding case belong to later planning and execution phases. Keeping the two distinct prevents premature commitment before feasibility is proven.

Question 30Migration Strategy, Assessment, and Planning

An application owner reports that a workload has no documented interface contracts and no active vendor support. How should the architect classify and treat this in the migration plan?

  1. Exclude it from the portfolio inventory because documentation is missing
  2. Treat it as a low-risk rehost and schedule it in the first wave
  3. Flag it as high-uncertainty, require deeper discovery, and consider retire or replace options before committing to a wave Correct answer.
  4. Assume it will be replatformed onto managed services without further analysis

Explanation

Missing interface documentation and absent vendor support raise both technical and operational risk, so the item needs deeper discovery and an explicit decision among retire, replace, replatform, or rehost. Placing it early or assuming a target platform without evidence would import unknown risk into the program. Excluding it from inventory hides a real dependency from the plan.

Question 31Migration Strategy, Assessment, and Planning

An architect must estimate the effort for migrating a mainframe-based COBOL application to OCI. Which planning input is most important before committing to a wave date?

  1. The count of physical network switches in the data center
  2. A detailed code and data dependency analysis covering batch jobs, file formats, and integration points Correct answer.
  3. The color scheme of the target application's user interface
  4. The number of OCI regions where the target could be deployed

Explanation

Mainframe workloads carry dense batch schedules, proprietary file formats, and tightly coupled integrations, so a code and data dependency analysis is the primary driver of effort and sequencing. Region options and data center hardware counts do not materially change the transformation effort. Without dependency analysis, wave dates rest on speculation.

Question 32Migration Strategy, Assessment, and Planning

A migration plan must satisfy a regulatory requirement that certain data never leaves a specific country. Which planning decision addresses this directly?

  1. Deploying the workload across multiple regions for redundancy
  2. Using a single availability domain in any region to reduce cost
  3. Selecting an OCI region within the required jurisdiction and confirming that all dependent services are available there Correct answer.
  4. Choosing the region with the lowest list price regardless of location

Explanation

Data residency is satisfied by placing data and processing in a region inside the mandated jurisdiction and verifying that every required service, including dependent managed services, is offered there. Cost-driven or multi-region choices that cross borders would violate the requirement. Multi-region redundancy is only acceptable when all chosen regions meet the residency constraint.

Question 33Migration Strategy, Assessment, and Planning

An assessment shows an application has a hard dependency on a hardware security module holding non-exportable keys. What planning action is most appropriate?

  1. Schedule the application in the final wave and defer all analysis until then
  2. Ignore the dependency because encryption is handled automatically in the cloud
  3. Replace the application with a spreadsheet-based workaround
  4. Plan a key migration or re-keying strategy and validate it in a test cutover before the production wave Correct answer.

Explanation

Non-exportable keys create a genuine migration blocker because the keys cannot simply be copied to a cloud HSM. The plan must define how keys are re-issued, wrapped, or re-established and prove that approach in a test cutover. Deferring analysis or assuming automatic handling leaves a critical dependency unresolved at the worst possible time.

Question 34Migration Strategy, Assessment, and Planning

When building the total cost of ownership comparison for a migration, which pair of cost categories is most often underestimated?

  1. The cost of the original data center lease signed years ago
  2. The purchase price of developer laptops
  3. Ongoing operations retooling and one-time application remediation effort Correct answer.
  4. Cloud compute list price and storage list price

Explanation

Teams typically model cloud infrastructure pricing well but undercount the people and effort costs: retraining operations staff, new tooling, and remediating applications for the target platform. These one-time and ongoing transition costs often determine whether the business case holds. Historical lease and hardware prices are sunk and do not inform the forward comparison.

Question 35Migration Strategy, Assessment, and Planning

A portfolio contains 40 applications, of which 12 are candidates for retirement. What is the correct treatment of those 12 in the migration plan?

  1. Remove them from the migration scope and plan decommissioning and dependency cleanup instead Correct answer.
  2. Migrate them first to preserve optionality
  3. Replatform them onto managed services to modernize the estate
  4. Rehost them to OCI to avoid difficult conversations with owners

Explanation

Retirement candidates should leave migration scope and instead get a decommissioning plan, including notifying consumers and removing shared dependencies. Migrating applications that are being retired wastes effort and adds avoidable risk. Retirement is usually the cheapest and fastest outcome available, so it should be captured early.

Question 36Migration Strategy, Assessment, and Planning

An architect is sequencing waves and wants to reduce the chance that a shared service becomes a bottleneck. Which approach is most sound?

  1. Migrate or establish the shared service early, or provide a validated interim connectivity path for consumers Correct answer.
  2. Migrate all consumers of a shared service before the shared service itself
  3. Defer all shared services to a separate program outside the plan
  4. Assume shared services never need migration

Explanation

Shared services such as directory, DNS, or messaging platforms are depended on by many applications, so they must either move early or be reachable through a validated interim path while consumers migrate. Moving consumers first strands them without their dependency. Assuming shared services are out of scope or pushing them to another program leaves a critical path unmanaged.

Question 37Migration Strategy, Assessment, and Planning

A migration plan proposes a big-bang cutover of 60 interdependent applications over a single weekend. Which assessment finding would most strongly argue for re-sequencing into smaller waves?

  1. The applications are written in several different programming languages
  2. The applications use different database versions
  3. The applications share a single authentication service and a common batch schedule with strict ordering Correct answer.
  4. The applications are owned by different business units

Explanation

A shared authentication service combined with a strictly ordered batch schedule means a single failure can cascade across all 60 applications at once, which is exactly the risk smaller waves are designed to contain. Language, ownership, and database version diversity increase complexity but do not by themselves create the same correlated failure risk. Re-sequencing limits blast radius and allows lessons learned to be applied.

Question 38Migration Strategy, Assessment, and Planning

During planning, an architect must choose between extending the data center network to OCI and building an independent target network. Which consideration most directly favors the independent target network?

  1. The availability of a single on-premises firewall vendor
  2. The preference to keep all workloads on a single flat subnet
  3. A requirement to eliminate long-term dependence on the legacy network and its addressing constraints Correct answer.
  4. The desire to minimize the number of OCI compartments

Explanation

Building an independent target network lets the architect design clean CIDR ranges, security models, and routing without inheriting legacy constraints, and it supports eventual decommissioning of the data center. Network extension is attractive for short-term connectivity but perpetuates dependence on the old environment. Compartment count and vendor uniformity are not the deciding factors.

Question 39Migration Strategy, Assessment, and Planning

An architect is validating whether a proposed migration wave can meet a four-hour recovery time objective after cutover. Which planning artifact is most directly relevant?

  1. The application's source code line count
  2. The number of historical change requests for the application
  3. A tested disaster recovery design for the target environment with measured failover and failback times Correct answer.
  4. The marketing website's content calendar

Explanation

An RTO commitment can only be validated by a disaster recovery design whose failover and failback have been measured in testing against that target. Code size and change history do not demonstrate recovery capability. The plan should treat an untested DR design as an unproven assumption rather than a satisfied requirement.

Question 40Migration Strategy, Assessment, and Planning

An assessment reveals that a business-critical application has no identified owner and no current documentation. What is the most appropriate next step in the migration plan?

  1. Migrate it as-is and document it after cutover
  2. Escalate to establish an accountable owner and fund discovery before assigning it to any wave Correct answer.
  3. Assign it to the first wave to force resolution
  4. Mark it as retired to remove it from scope

Explanation

An unowned, undocumented critical application cannot be safely planned because no one can approve changes, validate behavior, or accept cutover risk. The plan should escalate to establish accountability and fund discovery before scheduling. Forcing it into an early wave, silently retiring it, or documenting after cutover all transfer unmanaged risk onto the program.

Question 41Landing Zone, Identity, and Governance Design for Migration

When designing a landing zone in OCI for a large migration, which construct should you use to group compartments, policies, and budgets so that they can be managed and delegated as a single unit?

  1. A tenancy
  2. A region
  3. A compartment Correct answer.
  4. An availability domain

Explanation

Compartments are the primary OCI construct for isolating and grouping related resources such as compute, storage, and networking, and they serve as the scope for IAM policies and budgets. A tenancy is the root container, while regions and availability domains are physical or logical infrastructure boundaries, not governance groupings.

Question 42Landing Zone, Identity, and Governance Design for Migration

You are designing the identity model for a migration to OCI. Which statement correctly describes the relationship between a user, a group, and a policy in OCI IAM?

  1. Policies are attached directly to users to grant permissions.
  2. Users inherit permissions from the compartments they create.
  3. Users are placed in groups, and policies grant permissions to groups. Correct answer.
  4. Groups are placed in compartments, and policies grant permissions to compartments.

Explanation

In OCI IAM, permissions are granted through policies that name groups as the subject, and users receive those permissions by being members of the groups. Policies are not attached directly to users, and compartments are resources being governed rather than identity subjects.

Question 43Landing Zone, Identity, and Governance Design for Migration

A migration architect needs to enforce that all resources created in a production compartment carry a cost-center tag at creation time. Which OCI governance feature should be used?

  1. A budget alert rule
  2. An IAM policy with the manage all-resources verb
  3. A defined tag with a default value and a tag default Correct answer.
  4. A service limit increase request

Explanation

Tag defaults let you specify a defined tag key and value that OCI automatically applies to resources created in a compartment when the resource supports that tag. Budgets monitor spending, service limits control resource quotas, and broad IAM policies grant access rather than enforce metadata.

Question 44Landing Zone, Identity, and Governance Design for Migration

Which OCI IAM identity type should you use for automated migration tooling that runs outside OCI and must call OCI APIs without storing long-lived user credentials?

  1. A federated user authenticated through an identity provider
  2. An instance principal
  3. A dynamic group with an instance principal Correct answer.
  4. A local user with an API signing key

Explanation

A dynamic group matches compute instances by rule, and instance principals let those instances obtain short-lived credentials to call OCI APIs without embedding user secrets. A local user with a signing key is long-lived, while a federated user is intended for human interactive access.

Question 45Landing Zone, Identity, and Governance Design for Migration

When structuring compartments for a migration, which approach best supports both environment isolation and shared networking services?

  1. One compartment per availability domain
  2. One compartment per region with no environment separation
  3. Separate compartments per environment with a shared network compartment peered to each environment Correct answer.
  4. A single compartment for all environments to simplify policy management

Explanation

Separate environment compartments isolate production from non-production for policy and cost control, while a shared network compartment centralizes connectivity services that can be peered or connected to each environment. Flattening all environments into one compartment removes isolation, and availability domains are not a governance boundary.

Question 46Landing Zone, Identity, and Governance Design for Migration

You need to give a migration team the ability to manage compute instances in a specific compartment but nothing else in the tenancy. Which policy statement accomplishes this with least privilege?

  1. Allow group Migrators to read instances in compartment Migration
  2. Allow group Migrators to use instances in tenancy
  3. Allow group Migrators to manage instances in compartment Migration Correct answer.
  4. Allow group Migrators to manage all-resources in tenancy

Explanation

The policy scopes the manage verb for the instances resource family to the Migration compartment, granting full lifecycle control over instances there without affecting other resources or compartments. Broad tenancy-wide or all-resource grants exceed the requirement, and read or use verbs do not include create or delete.

Question 47Landing Zone, Identity, and Governance Design for Migration

A migration architect is asked to design a landing zone that supports multiple business units, each with its own budget and IAM administrator, while central IT retains control of networking. Which design pattern fits best?

  1. A single compartment per business unit with no parent hierarchy
  2. A separate tenancy for each business unit with no cross-tenancy connectivity
  3. A compartment hierarchy with a shared network compartment and per-business-unit compartments delegated through policies Correct answer.
  4. A flat tenancy with all resources in the root compartment and one administrator group

Explanation

A hierarchical compartment model lets central IT own the network compartment while delegating each business unit's compartment to its own administrators through scoped policies and budgets. A flat model removes delegation, separate tenancies complicate shared services, and sibling compartments without hierarchy lose centralized control.

Question 48Landing Zone, Identity, and Governance Design for Migration

Which OCI feature allows you to define a set of resources and apply IAM policies to them based on attributes such as compartment and resource type without listing each resource individually?

  1. Policy conditions Correct answer.
  2. Budget rules
  3. Identity domains
  4. Network security groups

Explanation

Policy conditions let a policy statement include attribute-based predicates, such as matching a resource type or compartment path, so a single policy can cover many resources. Identity domains manage users and groups, network security groups control traffic, and budget rules track spending.

Question 49Landing Zone, Identity, and Governance Design for Migration

During a migration, you must ensure that developers can create and manage resources in the Dev compartment but cannot delete the compartment itself or change its parent. Which policy verb set is most appropriate?

  1. use Correct answer.
  2. manage
  3. inspect
  4. read

Explanation

The use verb grants the ability to work with existing resources and create child resources where applicable, but it does not include the manage verb's ability to delete or alter the compartment hierarchy. The inspect and read verbs are progressively more limited and would not allow resource creation.

Question 50Landing Zone, Identity, and Governance Design for Migration

Which statement about OCI Identity Domains is correct when planning identity federation for a migration?

  1. A tenancy can contain multiple identity domains, each with its own users, groups, and identity providers. Correct answer.
  2. A tenancy can contain only one identity domain, which must be the default domain.
  3. Federation to an external IdP is possible only with the default identity domain.
  4. Identity domains are used only for resource compartments, not for users.

Explanation

OCI Identity Domains allow a tenancy to host multiple independent identity domains, each with separate user and group populations and its own federation configuration. This supports separating workforce, partner, or business-unit identities while keeping them in one tenancy.